CVE-2026-12214: Qihoo 360 Total Security Nucleus Engine Monitoring Logic RpcStringBindingComposeW protection mechanism

Synopsis

A protection mechanism failure vulnerability exists in the Nucleus Engine Monitoring Logic component of Qihoo 360 Total Security 6.0, specifically in the RpcStringBindingComposeW function. An attacker who already has a low-privilege local account can manipulate the NetworkAddr argument to bypass the intended protection mechanism, without needing any victim interaction or elevated rights. Successful exploitation gives the attacker full read, write, and crash capability over the affected process. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; the vulnerable code path is reachable only through local execution, not over the network.

• AuthenticationRequired

  Any low-privilege local account is sufficient to reach the vulnerable function; no administrative rights are needed.

• Victim interactionNot required

  No user interaction of any kind is required to trigger the vulnerability.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory layout dependencies, or other environmental factors are required.

Blast Radius

• A successful attacker reads confidential data from the affected process, including any in-memory secrets or credentials it holds.
• A successful attacker writes to or modifies data within the affected process, potentially altering security enforcement decisions made by the Nucleus Engine.
• A successful attacker can crash the Nucleus Engine Monitoring Logic process, disabling the protection and monitoring functions it provides.